REMARKS 

The present amendment is in response to tine Office Action dated 
September 10, 2007. Claims 1-5, 7-14, 23-30, and 32-43 are now present in tliis case. 
No Claims have been amended. No additional Claims are canceled. No new claims 
have been added. 

The undersigned requests the examiner schedule a phone interview prior 
to writing the next office action. 

Claims 1-4, 7-10, 13-14, 23-25, 27-30, and 32-35 stand rejected under 35 
U.S.C. § 103(a) as unpatentable by U.S. Patent No. 6,735,702 to Yavatkar et al. 
combined with U.S. Patent No. 6,842,781 to Lavian et al. The applicant respectfully 
traverses this rejection and request reconsideration. 

The current Office Action maintains the rejection from the previous Office 
Action, using a combination of the intrusion detection system of Yavatkar and the 
central network management system of Lavian. The Office Action finds this 
combination discloses the following element of Claim 1 : 

"receiving a request from a central server at a software agent program 
installed on each of a plurality of remote computers to initiate intrusion detection 
services on each respective one of the plurality of remote computers, wherein the 
request is issued by the central server in response to a notification of a network 
intrusion;" 

The Office Action states that Yavatkar is silent about operational control 
by a central server, (see Office Action, page 5.) Yavatkar is not silent about centralized 
control. Yavatkar explicityl describes disadvantages of centralized control and the 
advantages of decentralized operation. The applicants demonstrated in their response 
to the previous Office Action that there was no suggestion to combine the decentralized 
intrusion detection system of Yavatkar with centralized network management system of 
Lavian. (Previous Office Action, page 1 1 .) Furthermore, the applicants demonstrated 
Yavatkar teaches away from such a combination. E.g., "Mobile agents may determine, 
without exchanging information or commands from a central location or operator, which 
path to take to further investigate an attack." (Yavatkar, column 4, lines 30-35.) The 
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current Office Action does not dispute tliat Yavatkar teaclies away from combining witli 
Lavian. Instead, tine current Office Action asserts tliat Lavian makes a suggestion to 
combine: "providing a server for sending [a] request to a software agent to access other 
remote devices would allow the agent to perform [the] task at [a] critical moment when 
[an] attack is detected." (Current Office Action, page 2 citing for support Lavian column 
3, lines 22-50.) The applicants respectfully disagree that Lavian makes this suggestion. 

Lavian discloses a centralized network management system that 
incorporates some degree of de-centralization by taking many network management 
tasks traditionally performed on a centralized network management server and shifting 
these tasks to software agents on devices in the network. (Lavian, Abstract; column 1 , 
lines 35-50; column 3, lines 30-32.) Lavian discloses providing a server for sending 
requests to software agents. (Lavian, column 3, lines 23-50.) However, Lavian never 
discloses or mentions anything about an attack or countering intrusions to a network, 
much less that sending requests to an agent would allow the agent to perform tasks at a 
critical moment when an attack is detected. Furthermore, Lavian never discloses that 
the motivation of its system is to allow the agent to perform any critical task. On the 
contrary, the motivation in Lavin is the opposite, to shift mundane tasks to the agents 
while retaining critical tasks with the centralized server. E.g., "This reduces the 
processing load and frees up NMS [Network Monitor Server] 1 16 so that it can process 
more critical tasks." (Lavin, column 3, lines 25-33.) Thus Lavian also teaches away 
from a combination with Yavatkar. 

For at least these reasons, claim 1 is allowable over the combination of 
Yavatkar and Lavian. Claims 2-4, 7-10, and 13-14 are also allowable in view of the fact 
that they depend from claim 1 , and further in view of the recitation in each of those 
claims. 

The Office Action makes rejections of independent Claims 23 and 30 that 
similarly use a combination of Yavatkar and Lavian and restate the same motivation 
from Lavian to combine that the Office Action stated in the rejection of Claim 1 . As the 
applicants demonstrate above regarding Claim 1 , Yavatkar explicitly teaches away from 
centralized control. Lavian does not provide such a motivation and in fact teaches away 
from the combination of Yavatkar and Lavian. For at least this reason, the applicant 
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believe that Claims 23 and 30 are allowable over the combination of Yavatkar and 
Lavian. Claims 24, 25, 27-29, and 32-35 are also allowable in view of the fact that they 
depend from claim 1 , and further in view of the recitation in each of those claims. 

Claims 5, 1 1 , 1 2, 36-38, and 41 -43 stand rejected under 35 U.S.C. 
§ 1 03(a) as unpatentable over Yavatkar et al., combined with U.S. Patent No. 
6,842,781 to Lavian et al., and U.S. Patent Publication No. 2002/0003884 to Sprunk. 
The applicant respectfully traverses this rejection and request reconsideration. 

Claims 5,11,12, and 41 -43 are dependent on Claim 1 , and Claims 36-38 
are dependent on Claim 30. The Office Action relies on the same combination of 
Yavatkar and Lavian as applied to the base Claims 1 and 30 (the Office Action 
incorrectly states Claim 23). As the applicants demonstrate above regarding Claim 1 , 
Lavian and Yavatkar do not provide a motivation to combine and in fact, each teaches 
away from a combination of Yavatkar and Lavian. 

Sprunk does not cure this deficiency. As the applicants demonstrated in 
their response to the previous Office Action, Sprunk is directed to techniques for 
authorizing video download files. Sprunk is concerned with preventing a virus within a 
particular computer to prevent unauthorized access to the video file downloaded to that 
computer. This is significantly different from a network intrusion. Furthermore, Sprunk 
does not suggest any software agents or anti-intrusion software installed on the plurality 
of remote computers. 

For at least these reasons, the applicant believe that Claims 5, 11, 12, 36- 
38 and 41-43 are allowable over the combination of Yavatkar and Lavian. 

Claims 26 and 39-40 stand rejected under 35 U.S.C. § 103(a) as 
unpatentable over Yavatkar et al., Lavian et al. combined with U.S. Patent Application 
No. 6,401 ,238 to Brown et al.. The applicant respectfully traverses this rejection and 
request reconsideration. 

Claims 26 is dependent on independent base Claim 23 and Claims 39-40 
are dependent on independent base Claim 1 . The Office Action relies on the same 
combination of Yavatkar and Lavian as applied to the base Claims 1 and 23. As the 
applicants demonstrate above regarding Claim 1 and 23, Lavian and Yavatkar do not 
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provide a motivation to combine and in fact, eacli teaclies away from a combination of 
Yavatkar and Lavian. Brown does not cure tliis deficiency. 

Claim 26 adds an additional element to base Claim 23: 

"wherein said intrusion detection server changes the number of said 
plurality of computers executing intrusion detection software depending on the time of 
day." 

Against this, Brown is cited in the current and previous Office Actions as 
disclosing a deployment of applications based on time of day. In the applicants' 
response to the previous Office Action, the applicants demonstrated that Brown is 
unrelated to any intrusion detection technology and thus lacks any motivation to 
combine it with Yavatkar and Lavian. The current Office Action did not respond to this 
argument and merely repeated the same rejection. The applicants repeat their 
argument and respectfully ask the examiner to respond. 

For at least the reasons stated above, the applicants believe Claims 26, 
39, and 40 are allowable over the combination of Yavatkar, Lavian, and Brown. 

In view of the above amendments and remarks, reconsideration of the 
subject application and its allowance are kindly requested. The applicant has made a 
good faith effort to place all claims in condition for allowance. If questions remain 
regarding the present application, the Examiner is invited to contact the undersigned at 
(206) 757-8029. 

Respectfully submitted, 
Arturo Maria 

Davis Wright Tremaine llp 
/Philip R. Hunt, Reg. #58,044/ 
Philip R. Hunt 

PRH:gatc 

1201 Third Avenue 

Suite 2200 

Seattle, Wastiington 98101 
Ptione: (206) 757-8029 
Fax: (206) 757-7029 
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